Vulnerable Lab — VirtualServ

Intentionally vulnerable applications for educational and authorised training use only.

⚠ Disclaimer: These applications are intentionally vulnerable and exist solely for educational and authorised training purposes. Do not use real credentials or sensitive data. Unauthorised testing outside this environment is strictly prohibited.

Everything you do is logged. You will be prosecuted to the fullest extent of the law.
Read this in Liam Neeson's voice: "I. Will. Find. You."

Vulnerable Applications

🐘 DVWA Classic vulnerable PHP app — SQLi, XSS, CSRF, command injection.

🍋 OWASP Juice Shop Modern vulnerable SPA — JWT, REST/API, XSS, injection.

🐍 PyGoat Vulnerable Python app — secure coding and DevSecOps demos.

🔧 Microservices-cry A vulnerable ad hoc microservices application. 🐐 WebGoat Structured OWASP lessons. Not usually running — resource intensive. not always running 🐺 WebWolf Companion app for some WebGoat lessons. not always running

Lab Notes

Do not use real passwords or sensitive data in any of these applications.
If something breaks, containers can be reset from the host — contact the module team.
WebGoat and WebWolf are not always running due to resource constraints.
Report issues or unexpected behaviour to your instructor.

👨‍💻 About This Environment

A self-managed VPS hosting vulnerable applications and infrastructure services for authorised educational use in cybersecurity teaching.

Focus Areas

Cybersecurity demonstrations
CI/CD pipelines
Container orchestration
Monitoring & observability

Stack

Ubuntu 24.04
Apache
Docker
GitLab · Grafana · Portainer